20

The ca-certificates package was just updated, and it caused the following changes on my Xubuntu 13.10 system:

Running hooks in /etc/ca-certificates/update.d....
Adding debian:CA_Disig_Root_R1.pem
Adding debian:CA_Disig_Root_R2.pem
Adding debian:China_Internet_Network_Information_Center_EV_Certificates_Root.pem
Adding debian:D-TRUST_Root_Class_3_CA_2_2009.pem
Adding debian:D-TRUST_Root_Class_3_CA_2_EV_2009.pem
Adding debian:PSCProcert.pem
Adding debian:StartCom_Certification_Authority_2.pem
Adding debian:Swisscom_Root_CA_2.pem
Adding debian:Swisscom_Root_EV_CA_2.pem
Adding debian:TURKTRUST_Certificate_Services_Provider_Root_2007.pem
Adding debian:Verisign_Class_3_Public_Primary_Certification_Authority_2.pem
Removing debian:cacert.org_class3.pem
Removing debian:cacert.org_root.pem
Removing debian:Equifax_Secure_eBusiness_CA_2.pem
Removing debian:TC_TrustCenter_Universal_CA_III.pem

I've decided I don't trust some of these CAs, and I would like to remove their certificates. How do I do that?

1 Answer 1

36

Run

sudo dpkg-reconfigure ca-certificates

That should give you a list where you can deselect CAs.

The list of CAs is stored in the file /etc/ca-certificates.conf. If you edit this file manually you need to run

sudo update-ca-certificates

to update the actual certificates in /etc/ssl/certs/ (if you use dpkg-reconfigure that is done automatically).

See /usr/share/doc/ca-certificates/README.Debian for more information.

3
  • 1
    This worked flawlessly and was far easier than I expected it would be. The Debian contributors deserve a lot of credit for making it so painless. Thanks for your answer! Mar 29, 2014 at 13:48
  • ensure you don't have a package manager open. Mar 25, 2015 at 22:16
  • I downloaded a certificate, when I double click on it, gcr-viewer opens and allows me to import it using root password. But after the import, the file /etc/ca-certificates.conf does not contain it, any idea? here the question: askubuntu.com/questions/749073/… Mar 22, 2016 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.